Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| sveltejs | kit | unaffected |
|
No data.
No data.
No data available yet.
No remediation available yet.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 21 Oct 2026 00:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process. | |
| Title | SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows | |
| First Time appeared |
Svelte
Svelte kit |
|
| Weaknesses | CWE-22 | |
| CPEs | cpe:2.3:a:svelte:kit:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Svelte
Svelte kit |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-21T00:36:36.847Z
Reserved: 2026-10-20T21:43:23.218Z
Link: CVE-2026-114063
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-21T01:17:29.600
Modified: 2026-10-21T01:17:29.600
Link: CVE-2026-114063
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')